Tag: deals

Backdoor Found In WordPress Plugin With More Than 200,000 Installations

According to Bleeping Computer, a WordPress plug that goes by the name Display Widgets has been used to install a backdoor on WordPress sites across the internet for the past two and a half months. While the WordPress.org team removed the plugin from the official WordPress Plugins repository, the plugin managed to be installed on more than 200, 000 sites at the time of its removal. The good news is that the backdoor code was only found between Display Widgets version 2.6.1 (released June 30) and version 2.6.3 (released September 2), so it’s unlikely everyone who installed the plugin is affected. WordPress.org staff members reportedly removed the plugin three times before for similar violations. Bleeping Computer has compiled a history of events in its report, put together with data aggregated from three different investigations by David Law, White Fir Design, and Wordfence. The report adds: The original Display Widgets is a plugin that allowed WordPress site owners to control which, how, and when WordPress widgets appear on their sites. Stephanie Wells of Strategy11 developed the plugin, but after switching her focus to a premium version of the plugin, she decided to sell the open source version to a new developer who would have had the time to cater to its userbase. A month after buying the plugin in May, its new owner released a first new version — v2.6.0 — on June 21. Read more of this story at Slashdot.

See the original post:
Backdoor Found In WordPress Plugin With More Than 200,000 Installations

Equifax Blames Open-Source Software For Its Record-Breaking Security Breach

The blame for the record-breaking cybersecurity breach that affects at least 143 million people falls on the open-source server framework, Apache Struts, according to an unsubstantiated report by equity research firm Baird. The firm’s source, per one report, is believed to be Equifax. ZDNet reports: Apache Struts is a popular open-source software programming Model-View-Controller (MVC) framework for Java. It is not, as some headlines have had it, a vendor software program. It’s also not proven that Struts was the source of the hole the hackers drove through. In fact, several headlines — some of which have since been retracted — all source a single quote by a non-technical analyst from an Equifax source. Not only is that troubling journalistically, it’s problematic from a technical point of view. In case you haven’t noticed, Equifax appears to be utterly and completely clueless about their own technology. Equifax’s own data breach detector isn’t just useless: it’s untrustworthy. Adding insult to injury, the credit agency’s advice and support site looks, at first glance, to be a bogus, phishing-type site: “equifaxsecurity2017.com.” That domain name screams fake. And what does it ask for if you go there? The last six figures of your social security number and last name. In other words, exactly the kind of information a hacker might ask for. Equifax’s technical expertise, it has been shown, is less than acceptable. Could the root cause of the hack be a Struts security hole? Two days before the Equifax breach was reported, ZDNet reported a new and significant Struts security problem. While many jumped on this as the security hole, Equifax admitted hackers had broken in between mid-May through July, long before the most recent Struts flaw was revealed. “It’s possible that the hackers found the hole on their own, but zero-day exploits aren’t that common, ” reports ZDNet. “It’s far more likely that — if the problem was indeed with Struts — it was with a separate but equally serious security problem in Struts, first patched in March.” The question then becomes: is it the fault of Struts developers or Equifax’s developers, system admins, and their management? “The people who ran the code with a known ‘total compromise of system integrity’ should get the blame, ” reports ZDNet. Read more of this story at Slashdot.

View post:
Equifax Blames Open-Source Software For Its Record-Breaking Security Breach

TechCrunch: Equifax Hack-Checking Web Site Is Returning Random Results

An anonymous reader quotes security researcher Brian Krebs: The web site that Equifax advertised as the place where concerned Americans could go to find out whether they were impacted by this breach — equifaxsecurity2017.com — is completely broken at best, and little more than a stalling tactic or sham at worst. In the early hours after the breach announcement, the site was being flagged by various browsers as a phishing threat. In some cases, people visiting the site were told they were not affected, only to find they received a different answer when they checked the site with the same information on their mobile phones. TechCrunch has concluded that “the checker site, hosted by Equifax product TrustID, seems to be telling people at random they may have been affected by the data breach.” One user reports that entering the same information twice produced two different answers. And ZDNet’s security editor reports that even if you just enter Test or 123456, “it says your data has been breached.” TechCrunch writes: The assignment seems random. But, nevertheless, they were still asked to continue enrolling in TrustID. What this means is not only are none of the last names tied to your Social Security number, but there’s no way to tell if you were really impacted. It’s clear Equifax’s goal isn’t to protect the consumer or bring them vital information. It’s to get you to sign up for its revenue-generating product TrustID. Meanwhile, one web engineer claims the secret 10-digit “security freeze” PIN being issued by Equifax “is just a timestamp of when you made the freeze.” Read more of this story at Slashdot.

More:
TechCrunch: Equifax Hack-Checking Web Site Is Returning Random Results

An Intelligent Speed Bump Uses Non-Newtonian Liquid

turkeydance quotes Business Insider: A Spanish company has designed a speed bump that won’t hinder slow drivers but will still stop motorists driving too fast. The speed bump is filled with a non-Newtonian liquid which changes viscosity when pressure is applied at high velocity. They’ve been installed in Villanueva de Tapia, Spain and there has also been interest from Israel and Germany. There’s a video on the site showing the speed bump in action. Read more of this story at Slashdot.

Read this article:
An Intelligent Speed Bump Uses Non-Newtonian Liquid

AI Can Detect Sexual Orientation Based On Person’s Photo

ugen shares a report from CNBC: Artificial Intelligence (AI) can now accurately identify a person’s sexual orientation by analyzing photos of their face, according to new research. The Stanford University study, which is set to be published in the Journal of Personality and Social Psychology and was first reported in The Economist, found that machines had a far superior “gaydar” when compared to humans. Slashdot reader randomlygeneratename adds: Researchers built classifiers trained on photos from dating websites to predict the sexual orientation of users. The best classifier used logistic regression over features extracted from a VGG-Face conv-net. The latter was done to prevent overfitting to background, non-facial information. Classical facial feature extraction also worked with a slight drop in accuracy. From multiple photos, they achieved an accuracy of 91% for men and 83% for women (and 81% / 71% for a single photo). Humans were only able to get 61% and 54%, respectively. One caveat is the paper mentions it only used Caucasian faces. The paper went on to discuss how this capability can be an invasion of privacy, and conjectured that other types of personal information might be detectable from photos. The source paper can be found here. Read more of this story at Slashdot.

Read More:
AI Can Detect Sexual Orientation Based On Person’s Photo

Hackers Have Penetrated Energy Grid, Symantec Warns

An anonymous reader quotes a report from Fortune: Hackers have been burrowing their way inside the critical infrastructure of energy and other companies in the U.S. and elsewhere, warns cybersecurity giant Symantec. In a new report, Symantec claims that the threat of cyberattack-induced power outages in the west has elevated from a theoretical concern to a legitimate one in recent months. “We’re talking about activity we’re seeing on actual operational networks that control the actual power grid, ” Eric Chien, technical director of security technology and response at Symantec, told Fortune on a call. Reports surfaced over the summer of hackers targeting staff at nuclear energy facilities with phishing attacks, designed to steal login credentials or install malware on machines. The extent of the campaign as well as the question of whether the attackers had breached operational IT networks, rather than merely administrative ones, was unclear at the time. Symantec is now erasing all doubt. “There are no more technical hurdles for them to cause some sort of disruption, ” Chien said of the hackers. “All that’s left is really motivation.” Symantec detailed its findings in a report released Wednesday morning. The paper tracks the exploits of a hacker group that Symantec has dubbed DragonFly 2.0, an outfit that the company says it has linked to an earlier series of attacks perpetrated between 2011 and 2014 by a group it dubbed DragonFly. Read more of this story at Slashdot.

Read the original:
Hackers Have Penetrated Energy Grid, Symantec Warns

Boston Red Sox Used Apple Watches To Steal Hand Signals From Yankees

An anonymous reader quotes a report from Mac Rumors: Investigators for Major League Baseball believe the Boston Red Sox, currently in first place in the American League East, have used the Apple Watch to illicitly steal hand signals from opposing teams, reports The New York Times. The Red Sox are believed to have stolen hand signals from opponents’ catchers in games using video recording equipment and communicated the information with the Apple Watch. An inquiry into the Red Sox’ practice started two weeks ago following a complaint from Yankees general manager Brian Cashman, who caught a member of the Red Sox training staff looking at his Apple Watch in the dugout and then relaying information to players. It’s believed the information was used to determine the type of pitch that was going to be thrown. Baseball investigators corroborated the claim using video for instant replay and broadcasts before confronting the Red Sox. The team admitted that trainers received signals from video replay personnel and then shared them with some players. “The Red Sox told league investigators said that team personnel scanning instant- replay video were electronically sending the pitch signs to the trainers, who were then passing the information to the players, ” reports The New York Times. “The video provided to the commissioner’s office by the Yankees was captured during the first two games of the series and included at least three clips. In the clips, the team’s assistant athletic trainer, Jon Jochim, is seen looking at his Apple Watch and then passing information to outfielder Brock Holt and second baseman Dustin Pedroia, who was injured at the time but in uniform. In one instance, Pedroia is then seen passing the information to Young.” Read more of this story at Slashdot.

Originally posted here:
Boston Red Sox Used Apple Watches To Steal Hand Signals From Yankees

Nearly 3,000 Bitcoin Miners Exposed Online Via Telnet Ports, Without Passwords

An anonymous reader quotes a report from Bleeping Computer: Dutch security researcher Victor Gevers has discovered 2, 893 Bitcoin miners left exposed on the internet with no passwords on their Telnet port. Gevers told Bleeping Computer in a private conversation that all miners process Bitcoin transactions in the same mining pool and appear to belong to the same organization. “The owner of these devices is most likely a state sponsored/controlled organization part of the Chinese government, ” Gevers says, basing his claims on information found on the exposed miners and IP addresses assigned to each device. “At the speed they were taken offline, it means there must be serious money involved, ” Gevers added. “A few miners is not a big deal, but 2, 893 [miners] working in a pool can generate a pretty sum.” According to a Twitter user, the entire network of 2, 893 miners Gevers discovered could generate an income of just over $1 million per day, if mining Litecoin. Read more of this story at Slashdot.

View original post here:
Nearly 3,000 Bitcoin Miners Exposed Online Via Telnet Ports, Without Passwords

A Canadian University Gave $11 Million To a Scammer

A Canadian university transferred more than $11 million CAD (around $9 million USD) to a scammer that university staff believed to be a vendor in a phishing attack, a university statement published on Thursday states. From a report: Staff at MacEwan University in Edmonton, Alberta became aware of the fraud on Wednesday, August 23, the statement says. According to the university, the attacker sent a series of emails that convinced staff to change payment details for a vendor, and that these changes resulted in the transfer of $11.8 million CAD into bank accounts that the school has traced to Canada and Hong Kong. The school is working with authorities in Edmonton, Montreal, London, and Hong Kong, the statement reads. According to the university, its IT systems were not compromised and no personal or financial information was stolen. A phishing scam is not technically a “hack, ” it should be noted, and only requires the attacker to convince the victim to send money. The school’s preliminary investigation found that “controls around the process of changing vendor banking information were inadequate, and that a number of opportunities to identify the fraud were missed.” Read more of this story at Slashdot.

Original post:
A Canadian University Gave $11 Million To a Scammer

How the NSA Identified Satoshi Nakamoto

An anonymous reader shares a report: The ‘creator’ of Bitcoin, Satoshi Nakamoto, is the world’s most elusive billionaire. Very few people outside of the Department of Homeland Security know Satoshi’s real name. In fact, DHS will not publicly confirm that even THEY know the billionaire’s identity. Satoshi has taken great care to keep his identity secret employing the latest encryption and obfuscation methods in his communications. Despite these efforts (according to my source at the DHS) Satoshi Nakamoto gave investigators the only tool they needed to find him — his own words. Using stylometry one is able to compare texts to determine authorship of a particular work. Throughout the years Satoshi wrote thousands of posts and emails and most of which are publicly available. According to my source, the NSA was able to the use the ‘writer invariant’ method of stylometry to compare Satoshi’s ‘known’ writings with trillions of writing samples from people across the globe. By taking Satoshi’s texts and finding the 50 most common words, the NSA was able to break down his text into 5, 000 word chunks and analyse each to find the frequency of those 50 words. This would result in a unique 50-number identifier for each chunk. The NSA then placed each of these numbers into a 50-dimensional space and flatten them into a plane using principal components analysis. The result is a ‘fingerprint’ for anything written by Satoshi that could easily be compared to any other writing. The NSA then took bulk emails and texts collected from their mass surveillance efforts. First through PRISM and then through MUSCULAR, the NSA was able to place trillions of writings from more than a billion people in the same plane as Satoshi’s writings to find his true identity. The effort took less than a month and resulted in positive match. Read more of this story at Slashdot.

Visit site:
How the NSA Identified Satoshi Nakamoto